Hacker News new | past | comments | ask | show | jobs | submit login

As a long time Debian user in a professional environment I was really excited to see that Debian 8 finally added proper SELinux policies - however my colleagues and I were very disappointed to see that these (although working without noticeable issue) were dropped at the last minute with no explanation.

Several people in the community have asked what happened to the packages but had no reply from the Debian mailing list. I've asked several times on twitter but I too have had no response from the official Debian twitter account.

Sources:

* http://lists.alioth.debian.org/pipermail/selinux-devel/2015-...

* http://lists.alioth.debian.org/pipermail/selinux-devel/2015-...

* https://twitter.com/s_mcleod/status/589699467885948928

* https://twitter.com/s_mcleod/status/583172820802281472




It's unfortunate that you didn't get an answer from your posts in the mailing list but the package has been dropped because of those "grave/serious" bugs:

* https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=771484 * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756729

The main problem seems to be there is not enough manpower to keep those policies up-to-date. Once there are "grave/serious" bugs, a non-essential package is usually dropped from testing (hence from the next stable). If people care enough, this is usually a hint to fix those bugs.

If you want to help, you can help fixing thos bugs: https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=refpolicy

Once the bugs are fixed, the package can be backported to Jessie.


That's interesting indeed - I just don't see how a modern security conscious distribution can be considered releasable without SELinux working.

We were using them just fine in a pre-prod (waiting for Jessie to be released) environment. We weren't using GPG but experienced no other issues.

Right now, to get around the problem we have ported Fedora's policies across. I'm unsure if these two bugs exist when using Fedora's policies but I'd say they would be.


SELinux is not a release goal. It's possible to advocate for new release goals (for example, it is likely that reproducible build will be a release goal for the next release) but this means that some people have to volunteer to do the work.

I don't know enough SELinux to comment on the technical details.


can be considered releasable without SELinux

MAC is a JOKE. feds only wrote SELinux because largely they're required to use MAC. there are far better things to worry about than MAC unless youre getting paid triple digits per hour. windows had MAC forever, look how no ones uses it. i could go on.


Found out today when trying to setup HA that Pacemaker is also missing from Jessie because they didn't have time to fix a bug...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: